Minor freebsd issue on dovecot 2.4.5
On FreeBSD and MidnightBSD, Dovecot's net_getunixcred() relies on getpeereid(), which lacks PID info, causing every imap-login connection to register with anvil as pid=-1 and collide in its per-process hash. Here's an example fix for the problem. Note this was AI generated with claude fable and I don't know what your AI policy is. --- src/lib/net.c.orig 2026-08-28 00:00:00 UTC +++ src/lib/net.c @@ -9,6 +9,9 @@ #include <fcntl.h> #include <ctype.h> #include <sys/un.h> +#ifdef __FreeBSD__ +# include <sys/ucred.h> +#endif #include <netinet/tcp.h> #if defined(HAVE_UCRED_H) # include <ucred.h> /* for getpeerucred() */ @@ -832,6 +835,26 @@ cred_r->gid = ucred.unp_egid; cred_r->pid = ucred.unp_pid; return 0; +#elif defined(LOCAL_PEERCRED) && defined(__FreeBSD__) && __FreeBSD__
= 13 + /* FreeBSD 13+ / MidnightBSD 4+ (getpeereid() exists too, but struct + xucred also carries the peer pid, which anvil needs) */ + struct xucred ucred; + socklen_t len = sizeof(ucred); + + if (getsockopt(fd, 0, LOCAL_PEERCRED, &ucred, &len) < 0) { + i_error("getsockopt(LOCAL_PEERCRED) failed: %m"); + return -1; + } + + if (ucred.cr_version != XUCRED_VERSION) { + errno = EINVAL; + return -1; + } + + cred_r->uid = ucred.cr_uid; + cred_r->gid = ucred.cr_gid; + cred_r->pid = ucred.cr_pid; + return 0; #elif defined(HAVE_GETPEEREID) /* OSX 10.4+, FreeBSD 4.6+, OpenBSD 3.0+, NetBSD 5.0+ */ if (getpeereid(fd, &cred_r->uid, &cred_r->gid) < 0) {
On 29. Aug 2026, at 1.59, Lucas Holt via dovecot <dovecot@dovecot.org> wrote:
On FreeBSD and MidnightBSD, Dovecot's net_getunixcred() relies on getpeereid(), which lacks PID info, causing every imap-login connection to register with anvil as pid=-1 and collide in its per-process hash.
Here's an example fix for the problem. Note this was AI generated with claude fable and I don't know what your AI policy is.
Here's an updated version of the patch. Does it still work?
On 8/31/26 3:49 AM, Timo Sirainen wrote:
On 29. Aug 2026, at 1.59, Lucas Holt via dovecot <dovecot@dovecot.org> wrote:
On FreeBSD and MidnightBSD, Dovecot's net_getunixcred() relies on getpeereid(), which lacks PID info, causing every imap-login connection to register with anvil as pid=-1 and collide in its per-process hash.
Here's an example fix for the problem. Note this was AI generated with claude fable and I don't know what your AI policy is. Here's an updated version of the patch. Does it still work?
Yes. Your version of the patch works. I tested it on MidnightBSD 4.0.8.
Thanks Timo!
Lucas
Lucas Holt via dovecot <dovecot@dovecot.org> wrote:
On 8/31/26 3:49 AM, Timo Sirainen wrote:
Here's an updated version of the patch. Does it still work?
Yes. Your version of the patch works. I tested it on MidnightBSD 4.0.8.
And I am running Timo's patch on FreeBSD 15.1-STABLE for 24 hours now.
Thanks Timo!
Me too.
Regards, Michael
Timo Sirainen via dovecot <dovecot@dovecot.org> wrote:
On 29. Aug 2026, at 1.59, Lucas Holt via dovecot <dovecot@dovecot.org> wrote:
On FreeBSD and MidnightBSD, Dovecot's net_getunixcred() relies on getpeereid(), which lacks PID info, causing every imap-login connection to register with anvil as pid=-1 and collide in its per-process hash.
Here's an example fix for the problem. Note this was AI generated with claude fable and I don't know what your AI policy is.
Here's an updated version of the patch. Does it still work?
FYI: I have reacted to Lucas' mail 5 hours ago with yet another patch. Now, 5 hours later I receive your mail sent 10 (!) hours ago?!
Is it only me, or is there something weird ongoing with dovecot's mailing list software?
Sorry for the noise and regards, Michael
Lucas Holt via dovecot <dovecot@dovecot.org> wrote:
On FreeBSD and MidnightBSD, Dovecot's net_getunixcred() relies on getpeereid(), which lacks PID info, causing every imap-login connection to register with anvil as pid=-1 and collide in its per-process hash.
Here's an example fix for the problem. Note this was AI generated with claude fable and I don't know what your AI policy is.
I am experiencing the same issue with 'pid=-1', like: dovecot[34682]: anvil: Warning: conn unix:anvil (uid=0): Handshake with duplicate service=imap-login pid=-1 - replacing the old connection In src/lib/net.c I found: #elif defined(HAVE_SYS_UCRED_H) # include <sys/ucred.h> /* for FreeBSD struct xucred */ #endif BTW: HAVE_SYS_UCRED_H can be found both in 2.3 and 2.4 src/lib/net.c but *never* being used?! Thus I patched src/lib/net.c as follows (highly inspired by yor patch): --- src/lib/net.c.orig 2026-08-31 09:31:46.699701000 +0200 +++ src/lib/net.c 2026-08-31 09:45:40.751524000 +0200 @@ -832,6 +832,25 @@ cred_r->gid = ucred.unp_egid; cred_r->pid = ucred.unp_pid; return 0; +#elif defined(HAVE_SYS_UCRED_H) + /* FreeBSD 13+, MidnightBSD 4+ (may also provide getpeereid, but we also want pid) */ + struct xucred ucred; + socklen_t len = sizeof(ucred); + + if (getsockopt(fd, 0, LOCAL_PEERCRED, &ucred, &len) < 0) { + i_error("getsockopt(LOCAL_PEERCRED) failed: %m"); + return -1; + } + + if (ucred.cr_version != XUCRED_VERSION) { + errno = EINVAL; + return -1; + } + + cred_r->uid = ucred.cr_uid; + cred_r->gid = ucred.cr_gid; + cred_r->pid = ucred.cr_pid; + return 0; #elif defined(HAVE_GETPEEREID) /* OSX 10.4+, FreeBSD 4.6+, OpenBSD 3.0+, NetBSD 5.0+ */ if (getpeereid(fd, &cred_r->uid, &cred_r->gid) < 0) { This runs perfectly well for the last 24 hours and all anvil: messages disappeared. Now, there are a couple of FreeBSD switches in src/lib/net.c waiting for some cleanup as I assume ;-) Thanks and regards, Michael
Sorry, wrong patch in my previous mail. Michael Grimm <trashcan@ellael.org> wrote:
Lucas Holt via dovecot <dovecot@dovecot.org> wrote:
On FreeBSD and MidnightBSD, Dovecot's net_getunixcred() relies on getpeereid(), which lacks PID info, causing every imap-login connection to register with anvil as pid=-1 and collide in its per-process hash.
Here's an example fix for the problem. Note this was AI generated with claude fable and I don't know what your AI policy is.
I am experiencing the same issue with 'pid=-1', like:
dovecot[34682]: anvil: Warning: conn unix:anvil (uid=0): Handshake with duplicate service=imap-login pid=-1 - replacing the old connection
In src/lib/net.c I found:
#elif defined(HAVE_SYS_UCRED_H) # include <sys/ucred.h> /* for FreeBSD struct xucred */ #endif
BTW: HAVE_SYS_UCRED_H can be found both in 2.3 and 2.4 src/lib/net.c but *never* being used?!
Thus I patched src/lib/net.c as follows (highly inspired by yor patch):
--- src/lib/net.c.orig 2026-08-31 09:31:46.699701000 +0200 +++ src/lib/net.c 2026-08-31 09:45:40.751524000 +0200 @@ -832,6 +832,25 @@ cred_r->gid = ucred.unp_egid; cred_r->pid = ucred.unp_pid; return 0; +#elif defined(HAVE_SYS_UCRED_H) + /* FreeBSD 13+, MidnightBSD 4+ (may also provide getpeereid, but we also want pid) */ + struct xucred ucred; + socklen_t len = sizeof(ucred); + + if (getsockopt(fd, 0, LOCAL_PEERCRED, &ucred, &len) < 0) { + i_error("getsockopt(LOCAL_PEERCRED) failed: %m"); + return -1; + } + + if (ucred.cr_version != XUCRED_VERSION) { + errno = EINVAL; + return -1; + } + + cred_r->uid = ucred.cr_uid; + cred_r->gid = ucred.cr_gid; + cred_r->pid = ucred.cr_pid; + return 0; #elif defined(HAVE_GETPEEREID) /* OSX 10.4+, FreeBSD 4.6+, OpenBSD 3.0+, NetBSD 5.0+ */ if (getpeereid(fd, &cred_r->uid, &cred_r->gid) < 0) {
This runs perfectly well for the last 24 hours and all anvil: messages disappeared.
Now, there are a couple of FreeBSD switches in src/lib/net.c waiting for some cleanup as I assume ;-)
Thanks and regards, Michael
On 31/08/2026 16:06 EEST Michael Grimm via dovecot <[1]dovecot@dovecot.org> wrote: Lucas Holt via dovecot <[2]dovecot@dovecot.org> wrote: On FreeBSD and MidnightBSD, Dovecot's net_getunixcred() relies on getpeereid(), which lacks PID info, causing every imap-login connection to register with anvil as pid=-1 and collide in its per-process hash. Here's an example fix for the problem. Note this was AI generated with claude fable and I don't know what your AI policy is. I am experiencing the same issue with 'pid=-1', like: dovecot[34682]: anvil: Warning: conn unix:anvil (uid=0): Handshake with duplicate service=imap-login pid=-1 - replacing the old connection In src/lib/net.c I found: #elif defined(HAVE_SYS_UCRED_H) # include <sys/ucred.h> /* for FreeBSD struct xucred */ #endif BTW: HAVE_SYS_UCRED_H can be found both in 2.3 and 2.4 src/lib/net.c but *never* being used?! Thus I patched src/lib/net.c as follows (highly inspired by yor patch): --- src/lib/net.c.orig 2026-08-31 09:31:46.699701000 +0200 +++ src/lib/net.c 2026-08-31 09:45:40.751524000 +0200 @@ -832,6 +832,25 @@ cred_r->gid = ucred.unp_egid; cred_r->pid = ucred.unp_pid; return 0; +#elif defined(HAVE_SYS_UCRED_H) + /* FreeBSD 13+, MidnightBSD 4+ (may also provide getpeereid, but we also want pid) */ + struct xucred ucred; + socklen_t len = sizeof(ucred); + + if (getsockopt(fd, 0, LOCAL_PEERCRED, &ucred, &len) < 0) { + i_error("getsockopt(LOCAL_PEERCRED) failed: %m"); + return -1; + } + + if (ucred.cr_version != XUCRED_VERSION) { + errno = EINVAL; + return -1; + } + + cred_r->uid = ucred.cr_uid; + cred_r->gid = ucred.cr_gid; + cred_r->pid = ucred.cr_pid; + return 0; #elif defined(HAVE_GETPEEREID) /* OSX 10.4+, FreeBSD 4.6+, OpenBSD 3.0+, NetBSD 5.0+ */ if (getpeereid(fd, &cred_r->uid, &cred_r->gid) < 0) { This runs perfectly well for the last 24 hours and all anvil: messages disappeared. Now, there are a couple of FreeBSD switches in src/lib/net.c waiting for some cleanup as I assume ;-) Thanks and regards, Michael There is also https://github.com/dovecot/core/commit/ab03bf38b599a0fe22cb9b0b2a55470826800... now Aki References Visible links 1. mailto:dovecot@dovecot.org 2. mailto:dovecot@dovecot.org
Hi Aki -
On 1. Sep 2026, at 14:13, Aki Tuomi <aki.tuomi@open-xchange.com> wrote: There is also https://github.com/dovecot/core/commit/ab03bf38b599a0fe22cb9b0b2a55470826800... now
Yes, I am aware of that patch. If the mailing list wouldn't delay mails for 10+ hours I would have found Timo's patch long before presenting mine ;-)
Could you check the mailing list. The seems to be something hanging in the list if one follows https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/ …
Thanks and regards, Michael
participants (4)
-
Aki Tuomi
-
Lucas Holt
-
Michael Grimm
-
Timo Sirainen